Run command policy: allow an exact argv (literal elements, no glob) for a one-off approved command #3708

Problem

A caller that approves one specific blocked command can only pass that approval to a run as one more AgentCommandPolicy.allow entry (with AgentRunApproval). An allow entry is a whitespace-separated glob: * is a wildcard, and an element cannot contain whitespace or be empty. So many real commands cannot be allowed exactly:

• python -c "print(1)" and git commit -m "fix bug" have an argument containing spaces.
• An argument containing * is read as a wildcard, so the allowance becomes wider than the one command that was approved.

There is no way to say "allow exactly this argv, once".

Proposal

Add an exact-argv allowance to the run's command policy: a list of argv arrays (each element a literal string, no glob meaning), matched element for element against the command about to run. Behind a capability flag so a caller can tell whether the daemon supports it.

Open points for the maintainer:

• Whether an exact allowance is single-use within the run, or valid for the whole run.
• Whether it is checked before or after the hard-deny list (the safer default: hard denies still apply).

Acceptance criteria

• A command whose argv equals an exact allowance entry is allowed, including elements with spaces or *.
• A command that differs in any element is decided as today.
• Hard denies still refuse a command even when it matches an exact allowance.
• The run's audit events say the command was allowed by an exact allowance.
• Tests for each.